Privacy policy
This is a courtesy translation. The binding version is the Polish one. This English text is provided so that you can understand how your data is handled — it has no independent legal effect, and where the versions differ, the Polish version prevails.
This document says what data Courselob collects, why, on what legal basis, who receives it and how long it is kept. The Service runs no analytics, has no tracking pixels and no marketing cookies — which is why you will not see a cookie consent banner here.
Who the controller is
- The controller of your personal data is Piotr Zacharek, conducting sole-trader business activity under the name PIOTR ZACHAREK, registered office in Poznań, Poland, NIP 7821005108, REGON 631505817. Full address is given in § 1(1) of the Polish version.
- Contact on data matters: support@courselob.com.
- No data protection officer has been appointed — there is no obligation to do so. Write to the address above on all matters.
What data we collect
- When creating an account: email address and password (stored only as an irreversible hash — we do not know your password and cannot read it).
- When signing in with Google: email address and account identifier passed on by Google. We do not read contacts, files or history.
- When using the service: the course topic you type, the generated materials, the chosen language and course settings, Token usage and the chosen plan.
- When you contact us: the message, the email address and the time it was sent. This applies both to the contact form and to the chat in the panel.
- When paying: we neither collect nor see your card details. Stripe handles them (§ 5). We receive only the payment confirmation, its amount and status.
- Technical data: IP address and browser information, recorded in server logs for security purposes.
- We do not collect special categories of data (health, beliefs, religion and the like) and we ask that you do not put such information into the topics you type or into messages to us.
Why, and on what legal basis
Legal bases come from Article 6 of the GDPR — Regulation (EU) 2016/679.
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running an account | email, password, Google identifier | Art. 6(1)(b) — performance of a contract |
| Generating course materials | topic, settings, generated content | Art. 6(1)(b) — performance of a contract |
| Settling payments and plans | email, plan, payment status | Art. 6(1)(b) — performance of a contract |
| Issuing and keeping accounting documents | billing data | Art. 6(1)(c) — legal obligation |
| Handling complaints and withdrawals | correspondence, account data | Art. 6(1)(c) — legal obligation |
| Answering messages and support chat | email, message content | Art. 6(1)(f) — legitimate interest: replying to someone who wrote to us |
| Security, preventing abuse | IP address, server logs | Art. 6(1)(f) — legitimate interest: protecting the Service and its users |
| Establishing and pursuing claims, or defending against them | account data, correspondence, billing | Art. 6(1)(f) — legitimate interest |
We send no newsletter and no marketing messages. If we ever start, we will ask for separate consent first, revocable with one click.
How long we keep it
| Data | Period |
|---|---|
| Account and generated materials | while the account exists; after deletion — up to 30 days to undo an accidental deletion, then permanently erased |
| Accounting documents | 5 years from the end of the tax year in which the tax obligation arose — required by law |
| Correspondence and support chat | up to 2 years from the last message |
| Data needed for claims | until the limitation period expires, usually 6 years |
| Server logs | up to 12 months |
Who receives it
- We use companies that process data on our behalf under data processing agreements. The list below is complete — we pass data to nobody outside it.
- We do not sell data and do not share it for marketing purposes with anyone.
| Who | What for | What data |
|---|---|---|
| Supabase | database, sign-in, file storage — servers in the European Union | email, password hash, materials, correspondence |
| Vercel | hosting the site and server functions — functions run in Frankfurt | technical data, request content |
| Telegram | notifying the support team that a new message arrived — servers outside the European Economic Area | your email address and the content of your message |
| Stripe | payment handling | email, amount, card details — processed by Stripe only |
| Anthropic | the model that writes course content and answers in the help chat | course topic and generation parameters; the question you type in the chat |
| Resend | sending email (purchase confirmations, password recovery) | recipient email address and message content |
| ntfy.sh | notifying the team about a new message from a user | sender email address and message content |
| Google (search) | fetching the search results shown inside a lesson video | the search phrase |
| Pexels | photo search for lessons and the course page | a search phrase built from the course topic; when photos are displayed, also the visitor's IP address and browser details |
| ElevenLabs | voice synthesis | the text to be read aloud |
| sign-in with Google — only if you use it | email, account identifier |
- Data may be disclosed to state authorities where required by law.
- Fonts and libraries needed for the site to work are loaded from our own server — no content delivery networks, tracking pixels or third-party scripts. One exception: the photos illustrating courses load directly from Pexels servers, so displaying them sends your IP address and browser details to that provider. Otherwise your IP address does not reach anyone beyond the table above.
Transfers outside Europe
- Your account, courses and correspondence are stored on servers in the European Union. The Service's server functions run in Frankfurt.
- Only data strictly needed for a specific operation is transferred outside the
European Economic Area, to the United States:
- Pexels — a photo search phrase built from the course topic, when the page picks images;
- Resend — your email address and the message content, when we send you a confirmation or a password-reset link;
- ntfy.sh — your email address and message content, when you write to the team (a notification for us);
- Anthropic — the course topic and generation parameters, when you ask for materials to be generated;
- ElevenLabs — the text to be read aloud, when you use the narrator;
- Google — email address and account identifier, only if you sign in with Google;
- Stripe — payment data, processed by Stripe Payments Europe based in Ireland, with possible support from affiliates outside the EEA.
- Separately, outside the EEA to the United Arab Emirates, we transfer your email address and the content of the message you send us — to Telegram FZ-LLC. The reason is a single one: notifying the support team that you are waiting for an answer. If you prefer your message not to leave Europe, write directly to support@courselob.com — email does not travel this route.
- Transfers take place on the basis of standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR) or, for providers in the Data Privacy Framework, on the basis of an adequacy decision (Art. 45 GDPR).
- We will provide a copy of the safeguards used on request sent to support@courselob.com.
Your rights
- You have the right to:
- access your data and receive a copy;
- rectify data that is incorrect or incomplete;
- erasure (“the right to be forgotten”);
- restriction of processing;
- data portability — receiving it in a machine-readable format or having it sent to another controller;
- object to processing based on legitimate interest (Art. 6(1)(f)).
- Send your request to support@courselob.com from the address linked to your account. We answer without delay and within one month at the latest.
- You have the right to lodge a complaint with the supervisory authority — the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
- Exercising these rights is free of charge.
Is providing data obligatory
- Providing data is voluntary but necessary to use the service.
- Without an email address you cannot create an account or keep the materials you generate.
- The topic analysis, title suggestions and section plan can be seen without creating an account — a typed topic is enough.
Automated decisions and profiling
- We take no decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you.
- The Service uses an artificial intelligence model to create course content from the topic you supply. The model does not assess you and takes no decisions about you — it processes only the content you type yourself.
- We do not profile users for advertising.
Browser storage and cookies
- The Service uses no analytics or marketing cookies and no tracking tools. That is why there is no cookie consent banner — there is nothing to consent to.
- We store in your browser only what the service needs to work:
- the chosen site language and course language;
- the course you are working on and your Token usage;
- the chosen plan;
- session data — without it every page change would require signing in again.
- This data stays on your device and you can delete it at any time in your browser settings. Deleting session data signs you out.
Security
- The connection to the Service is encrypted (HTTPS).
- Passwords are stored only as irreversible hashes. We do not know your password and will never ask for it — including when you write to support.
- Access to data in the database is limited by rules enforced on the server side: each user sees only their own courses and their own correspondence.
- Only people named individually in the database configuration have access to the support panel.
- If a personal data breach occurs that may result in a high risk to your rights, we will notify you without undue delay, and the supervisory authority within 72 hours.
Changes to this policy
- We may change this policy, in particular where the law, the scope of services or the list of providers in § 5 changes.
- Account holders are notified by email at least 14 days before a material change takes effect.
- The version and the date it applies from are always given at the top.